EC2Config service is a nifty Windows service provided by Amazon that performs many important chores on instances based on AWS Windows Server 2003-2012 R2 AMIs. These tasks include (but are not limited to):
- Initial start-up tasks when the instance is first started (e.g. executing the user data, setting random Administrator account password etc)
- Display wallpaper information to the desktop background.
- Run Sysprep and shut down the instance
More details about this service can be found at Amazon’s webpage
Another important aspect of EC2Config service is that it can be configured to send performance metrics to CloudWatch. Example of these metrics are Available Memory, Free Disk Space, Page File Usage to name a few. The problem we faced is sometimes this service will either stop or fail to start due to a misconfigured configuration file. Having this service running all the time was critical for monitoring and compliance reasons.
To make sure that this service was running and publishing metrics to CloudWatch, we came up with a simple solution. We used a Python script written as a Lambda function to query Windows performance metrics for the last 10 minutes (function scheduled to run every 30-minute interval configurable through Lambda Trigger) and if the metric was missing, send an alert.
Following is the code written for this purpose. The salient features of the code are:
- The function lambda_handler is invoked by Lambda
- Variable are initialised, currently these are coded in to the function but they can also be parametrized using Environment Variables feature of a Lambda function
- Ec2 and CloudWatch objects are initialised
- Running Instances are retrieved based on “running” filter
- If an Instance is running for less than the period requested than ignore this instance (this avoids false alarms for instances started in the last few minutes)
- Cloudwatch metric ‘Available Memory’ for the instance is retrieved for last 10 min. This can be substituted with any other metric name. Please also take note of the Dimension of the metric
- Datapoint result is inspected, if no Datapoint is found this instance is added to a list (later used for alert)
- If the list has some values, an alert is sent via SNS topic
[sourcecode language=”python” wraplines=”false” collapse=”false”]
#
#
# AWS Lambda Python script to query for Cloudwatch metrics for all running
# EC2 instance and if unavailable send a message through an SNS topic
# to check for EC2Config service
#
# Required IAM permissions:
# ec2:DescribeInstances
# sns:Publish
# cloudwatch:GetMetricStatistics
#
# Setup:
# Check these in the code (Search *1 and *2):
# *1: Confirm details of the parameters
# *2: Confirm details of the dimensions
#
from __future__ import print_function
import boto3,sys,os
from calendar import timegm
from datetime import datetime, timedelta
def check_tag_present(instance, tag_name, tag_value):
for tag in instance.tags:
if tag[‘Key’] == tag_name:
if tag[‘Value’] == tag_value:
return True
return False
def send_alert(list_instances, topic_arn):
if topic_arn == "":
return
instances = ""
for s in list_instances:
instances += s
instances += "\n"
subject = "Warning: Missing CloudWatch metric data"
message = "Warning: Missing CloudWatch metric data for the following instance id(s): \n\n" + instances + "\n\nCheck the EC2Config service is running and the config file in C:\\Program Files\\Amazon\\Ec2ConfigService\\Settings is correct."
client = boto3.client(‘sns’)
response = client.publish(TargetArn=topic_arn,Message=message,Subject=subject)
print ("*** Sending alert ***")
def lambda_handler(event, context):
# *1-Provide the following information
_instancetagname = ‘Environment’ # Main filter Tag key
_instancetagvalue = ‘Prod’ # Main filter Tag value
_period = int(10) # Period in minutes
_namespace = ‘WindowsPlatform’ # Namespace of metric
_metricname = ‘Available Memory’ # Metric name
_unit = ‘Megabytes’ # Unit
_topicarn = ” # SNS Topic ARN to write message to
_region = "ap-southeast-2" # Region
ec2 = boto3.resource(‘ec2’,_region)
cw = boto3.client(‘cloudwatch’,_region)
filters = [{‘Name’:’instance-state-name’,’Values’:[‘running’]}]
instances = ec2.instances.filter(Filters=filters)
now = datetime.now()
print(‘Reading Cloud watch metric for last %s min\n’ %(_period))
start_time = datetime.utcnow() – timedelta(minutes=_period)
end_time = datetime.utcnow()
print ("List of running instances:")
list_instances=[]
for instance in instances:
if check_tag_present(instance, _instancetagname, _instancetagvalue)==False:
continue #Tag/Value missing, ignoring instance
print ("Checking ", instance.id)
i=1
date_s=instance.launch_time
date_s=date_s.replace(tzinfo=None)
new_dt = datetime.utcnow() – date_s
instance_name = [tag[‘Value’] for tag in instance.tags if tag[‘Key’] == ‘Name’][0]
minutessince = int(new_dt.total_seconds() / 60)
if minutessince < _period:
print ("Not looking for data on this instance as uptime is less than requested period.\n")
continue
metrics = cw.get_metric_statistics(
Namespace=_namespace,
MetricName=_metricname,
Dimensions=[{‘Name’: ‘InstanceId’,’Value’: instance.id}],
StartTime=start_time,
EndTime=end_time,
Period=300,
Statistics=[‘Maximum’],
Unit=_unit
)
datapoints = metrics[‘Datapoints’]
for datapoint in datapoints:
if datapoint[‘Maximum’]:
print (i,")\nDatapoint Data:",datapoint[‘Maximum’],"\nTimeStamp: ",datapoint[‘Timestamp’],"\n")
i+=1
else:
print ("Cloudwatch has no Maimum metrics for",_metricname,"instance id: ", instance.id)
if i == 1: #No data point found
print ("Cloudwatch has no metrics for",_metricname," for instance id: ", instance.id)
list_instances.append(instance_name + " (" + instance.id+ ")" + ", CW Server Name: " + cw_server_name)
print ("=================================================\n")
if len(list_instances) > 0:
send_alert(list_instances, _topicarn)
[/sourcecode]
Please note: The function needs some permissions to execute, so the following policy should be attached to lambda function’s role:
[sourcecode language=”perl” wraplines=”false” collapse=”false”]
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "Stmt1493179460000",
"Effect": "Allow",
"Action": ["ec2:DescribeInstances"],
"Resource": ["*"]
},
{
"Sid": "Stmt1493179541000",
"Effect": "Allow",
"Action": ["sns:Publish"],
"Resource": ["*"]
},
{
"Sid": "Stmt1493179652000",
"Effect": "Allow",
"Action": ["cloudwatch:GetMetricStatistics"],
"Resource": ["*"]
}]
}
[/sourcecode]